MS-102 Practice Test 10 — 10 Questions

Question 1

Your organization uses Microsoft Purview Information Protection. You need to ensure that when users manually apply a 'Confidential' label to a document in Word, the document is automatically marked with a footer 'CONFIDENTIAL' and encrypted. What must you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the sensitivity label's settings to include the footer and encryption.. D is correct because sensitivity labels include built-in settings for markings (like footers) and encryption, which are configured within the label's properties. Option A is incorrect because the sensitivity label policy determines which labels are published to users, but the actual marking and encryption settings are defined in the label itself, not in the policy. Option B is incorrect because DLP rules apply to data loss prevention scenarios, not to sensitivity label application; they cannot be used to apply footers or encryption when a user manually applies a label. Option C is incorrect because auto-labeling is used for automatically applying labels based on conditions, not for manual labeling scenarios.

Answer

Modify the sensitivity label policy to include the footer.

Answer

Create a DLP rule that applies the footer and encryption.

Answer

Set up auto-labeling to apply the footer and encryption.

Question 2

You are planning a Microsoft 365 tenant migration from another tenant. You need to migrate email, OneDrive, and SharePoint content. Which THREE tools or methods can you use to migrate data?

Accepted Answer

Microsoft 365 Migration Manager. Microsoft 365 Migration Manager (A) is a native tool in the admin center that supports cross-tenant migrations for Exchange Online, OneDrive, and SharePoint, making it suitable for this scenario. Third-party tools like BitTitan MigrationWiz (C) are widely used for tenant-to-tenant migrations and can handle all three workloads. PowerShell scripts using Microsoft Graph API (E) allow custom migration scripts to migrate email, OneDrive, and SharePoint data, providing flexibility. Option B (Microsoft Teams admin center) is incorrect because it is for managing Teams settings, not migrating content. Option D (Exchange Admin Center migration tools) is incorrect because those tools are limited to mailbox migrations and do not cover OneDrive or SharePoint.

Answer

Microsoft Teams admin center

Answer

Exchange Admin Center migration tools

Question 3

Your company recently merged with another company that uses Microsoft 365. Both tenants have the same primary domain, contoso.com. You need to merge the two tenants into a single tenant while preserving user email addresses. What should you do?

Accepted Answer

Remove the domain from the source tenant and add it to the target tenant, then migrate users.. To merge two Microsoft 365 tenants with the same domain, you must remove the domain from the source tenant, add it to the target tenant, and then migrate users' data. This preserves user email addresses because the domain is added to the target tenant before migration. Option B is the correct approach.

Answer

Use cross-tenant collaboration settings to share the domain.

Answer

Configure a domain sharing agreement between both tenants.

Answer

Set up a federation trust between the two tenants.

Question 4

A security administrator needs to view a unified incident queue that correlates alerts from Microsoft Defender for Endpoint, Microsoft Defender for Office 365, and Microsoft Defender for Identity. Which console should the administrator open?

Accepted Answer

Microsoft 365 Defender portal (security.microsoft.com). The Microsoft 365 Defender portal (security.microsoft.com) provides a unified incident queue that aggregates and correlates alerts from Microsoft Defender for Endpoint, Defender for Office 365, Defender for Identity, and Defender for Cloud Apps. This single-pane-of-glass view enables security administrators to investigate and respond to cross-domain threats without switching between separate consoles.

Answer

Azure Security Center

Answer

Microsoft Endpoint Manager admin center

Answer

Microsoft Purview compliance portal

Question 5

Your organization uses Microsoft Defender for Office 365. You have configured a safe attachment policy that should automatically detonate attachments in a sandbox before delivery. However, some users still receive malicious attachments. What should you check first?

Accepted Answer

Verify that the Safe Attachments policy is applied to the affected users and that the action is set to 'Dynamic Delivery' or 'Replace' (not 'Monitor').. Safe Attachments policies can be configured with actions like 'Dynamic Delivery' or 'Replace' to actively block or detonate attachments before delivery. If the action is set to 'Monitor', attachments are delivered first and only monitored, which can allow malicious attachments to reach users. Therefore, verifying the policy action is the first step to ensure detonation occurs before delivery.

Answer

Check whether a mail flow rule (transport rule) is bypassing Safe Attachments.

Answer

Check the Safe Links policy configuration.

Answer

Review the mailbox audit log for each affected user.

Question 6

A company wants to require that all users accessing a critical cloud application for the first time must accept a company terms of use before they are granted access. Which Conditional Access policy grant control should be added?

Accepted Answer

Require terms of use. The 'Require terms of use' grant control in a Conditional Access policy is specifically designed to force a user to accept a company's terms of use (TOU) before accessing a cloud application. When this control is enabled, Microsoft Entra ID presents the TOU document to the user on first access, and access is blocked until the user explicitly accepts the terms. This directly meets the requirement of requiring acceptance before granting access.

Answer

Require multi-factor authentication

Answer

Require device to be marked as compliant

Answer

Require approved client app

Question 7

Your organization is planning to deploy Microsoft 365 Copilot. You need to ensure that all prerequisites are met. Which of the following is a mandatory prerequisite for enabling Microsoft 365 Copilot?

Accepted Answer

Microsoft Entra ID P2 licenses.. None of the listed options are mandatory prerequisites for Microsoft 365 Copilot. The actual mandatory requirements are a qualifying Microsoft 365 license (E3, E5, or Business Premium) and the Microsoft 365 Copilot add-on license. Microsoft Entra ID P2 is not required; a basic Entra ID (free) is sufficient. Purview DLP, an Azure subscription, and Exchange Online Plan 2 are also not mandatory.

Answer

Microsoft Purview Data Loss Prevention policies.

Answer

An active Azure subscription.

Answer

Exchange Online Plan 2 licenses.

Question 8

You are configuring Microsoft Entra ID provisioning for a SaaS application that supports SCIM 2.0. The app requires the 'manager' attribute to be mapped. However, the manager attribute is not populated for all users. What should you do to avoid provisioning failures?

Accepted Answer

Configure the attribute mapping to 'Ignore it if null' for the manager attribute. When the 'manager' attribute is not populated for all users, configuring the attribute mapping to 'Ignore it if null' prevents provisioning failures by allowing the provisioning service to skip the attribute when its value is null, rather than attempting to send an empty or invalid value that the SCIM 2.0 endpoint might reject. This setting ensures that only users with a manager value trigger the mapping, avoiding errors for users without a manager.

Answer

Modify the SCIM schema in the application to make manager optional

Answer

Use the expression language to set a default value for the manager attribute

Answer

Delete the manager attribute mapping from the provisioning configuration

Question 9

A development team builds a background service that needs to read all users' calendars via Microsoft Graph without a signed-in user. The service will run on a server with a client secret. Which OAuth 2.0 grant flow should the application use?

Accepted Answer

Client credentials grant. The client credentials grant is designed for server-to-server, non-interactive scenarios where an application authenticates as itself (not on behalf of a user) to access resources. Since the background service runs with a client secret and needs to read all users' calendars without a signed-in user, this flow is the correct choice because it uses the application's own identity to obtain an access token from Microsoft Entra ID.

Answer

Authorization code grant

Answer

Device authorization grant

Answer

Implicit grant

Question 10

An organization wants to configure Self-Service Password Reset (SSPR) for all users. The administrator must ensure that users register two authentication methods: one from the mobile app category (e.g., notification or code) and one from the phone call category (e.g., office phone or mobile phone). Which combination of methods should the administrator select in the SSPR settings?

Accepted Answer

Mobile app notification and Office phone. The SSPR policy requires users to register two authentication methods from distinct categories. The mobile app notification (from the mobile app category) and office phone (from the phone call category) satisfy this requirement. This combination ensures that users have one method from the mobile app category and one from the phone call category, as specified in the question.

Answer

Mobile app code and Security questions

Answer

Email and Mobile phone

Answer

Security questions and Office phone